Which of the following is the BEST way for a risk practitioner to verify that management has addressed control issues identified during a previous external audit?

A. Inspect external audit documentation.
B. Review management’s detailed action plans.
C. Observe the control enhancements in operation.
D. Interview control owners.